VMSA-2020-0019

Moderate

Advisory ID: VMSA-2020-0019

CVSSv3 Range: 4.5

Issue Date: 2020-08-20

Updated On: 2020-08-20 (Initial Advisory)

CVE(s): CVE-2020-3975

Synopsis: VMware App Volumes patches address Stored Cross-Site Scripting (XSS) vulnerability (CVE-2020-3975)

1. Impacted Products

VMware App Volumes

2. Introduction

A Stored Cross-Site Scripting (XSS) vulnerability affecting VMware App Volumes was privately reported to VMware. Updates are available to address this vulnerability in affected VMware products.

3a. Advisory Details

Description

VMware App Volumes does not correctly validate user input when creating and editing applications or creating storage groups. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 4.5.

Known Attack Vectors

A malicious actor with access to create and edit applications or create storage groups, may be able to inject malicious script which will be executed by a victim's browser when viewing.

Resolution

To remediate CVE-2020-3975 apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' below.

Workarounds

None.

Additional Documentation

None.

Notes

None.

Acknowledgements

VMware would like to thank Maarten Pentinga of Dienst Uitvoering Onderwijs (DUO) for reporting this issue to us.

Response Matrix

Product	Version	Running On	CVE Identifier	CVSSv3	Severity	Fixed Version	Workarounds	Additional Documentation
App Volumes	2.x	Any	CVE-2020-3975	4.5	moderate	2.18.6	None	None
App Volumes	4	Any	CVE-2020-3975	4.5	moderate	2006	None	None